{"id":"CVE-2024-27288","aliases":["EUVD-2024-0784","GHSA-26w3-q4j8-4xjp","GO-2024-2613"],"status":"published","title":"1Panel open source panel project has an unauthorized vulnerability.","description":"1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00471,"percentile":0.41044,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2024-03-06T15:29:11Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"Go","package":"github.com/1Panel-dev/1Panel","fixed_in":["1.10.1-lts"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/1Panel-dev/1Panel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.10.0-lts"},{"fixed":"1.10.1-lts"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/1Panel-dev/1Panel","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.10.1-lts"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/1Panel-dev/1Panel","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.10.1-lts"}]}]}],"products":[{"vendor":"1panel-dev","product":"1panel"},{"vendor":"fit2cloud","product":"1panel"}],"references":[{"url":"https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-26w3-q4j8-4xjp","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/1Panel-dev/1Panel/releases/tag/v1.10.1-lts","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27288","tags":["advisory"]},{"url":"https://github.com/1Panel-dev/1Panel/pull/4014","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-26w3-q4j8-4xjp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27288.json","tags":["advisory"]},{"url":"https://github.com/1Panel-dev/1Panel","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-27288","title":"1Panel open source panel project has an unauthorized vulnerability.","description":"1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds.","status":"published","published":"2024-03-06T18:23:50.053Z","modified":"2024-08-27T16:52:53.993Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:12.982241Z"}],"euvd":[{"id":"EUVD-2024-0784","description":"1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds.","status":"published","published":"2024-03-06T18:23:50Z","modified":"2024-08-27T16:52:53Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:56:10.428773Z"}],"ghsa":[{"id":"GHSA-26w3-q4j8-4xjp","title":"1Panel open source panel project has an unauthorized vulnerability.","description":"### Impact\n\nThe steps are as follows:\n\n1. Access https://IP:PORT/ in the browser, which prompts the user to access with a secure entry point.\n![image](https://github.com/1Panel-dev/1Panel/assets/46734380/8dc7d81c-6cc3-4b5d-a1d4-d3c5ed2de005)\n\n2. Use Burp to intercept:\n![image](https://github.com/1Panel-dev/1Panel/assets/46734380/f8e93d08-1b66-4434-8923-2e8e3dedebe3)\n\nWhen opening the browser and entering the URL (allowing the first intercepted packet through Burp), the following is displayed:\n![image](https://github.com/1Panel-dev/1Panel/assets/46734380/118c0102-7c89-404d-834a-88a644482afc)\n\nIt is found that in this situation, we can access the console page (although no data is returned and no modification operations can be performed).\"\n\nAffected versions: \u003c= 1.10.0-lts\n\n### Patches\n\nThe vulnerability has been fixed in v1.10.1-lts.\n\n### Workarounds\n\nIt is recommended to upgrade the version to 1.10.1-lts.\n\n### References\n\nIf you have any questions or comments about this advisory:\n\nOpen an issue in https://github.com/1Panel-dev/1Panel\nEmail us at wanghe@fit2cloud.com","status":"published","published":"2024-03-06T15:29:11Z","modified":"2025-02-11T19:03:39Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:38:30.754382Z"}],"nvd":[{"id":"CVE-2024-27288","description":"1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds.","status":"published","published":"2024-03-06T19:15:07.933Z","modified":"2026-06-17T07:19:34.88Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:09:39.488031Z"}],"osv":[{"id":"CVE-2024-27288","title":"1Panel open source panel project has an unauthorized vulnerability.","description":"1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds.","status":"published","published":"2024-03-06T18:23:50.053Z","modified":"2026-10-28T02:31:04.488685905Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"GHSA-26w3-q4j8-4xjp","title":"1Panel open source panel project has an unauthorized vulnerability.","description":"### Impact\n\nThe steps are as follows:\n\n1. Access https://IP:PORT/ in the browser, which prompts the user to access with a secure entry point.\n![image](https://github.com/1Panel-dev/1Panel/assets/46734380/8dc7d81c-6cc3-4b5d-a1d4-d3c5ed2de005)\n\n2. Use Burp to intercept:\n![image](https://github.com/1Panel-dev/1Panel/assets/46734380/f8e93d08-1b66-4434-8923-2e8e3dedebe3)\n\nWhen opening the browser and entering the URL (allowing the first intercepted packet through Burp), the following is displayed:\n![image](https://github.com/1Panel-dev/1Panel/assets/46734380/118c0102-7c89-404d-834a-88a644482afc)\n\nIt is found that in this situation, we can access the console page (although no data is returned and no modification operations can be performed).\"\n\nAffected versions: \u003c= 1.10.0-lts\n\n### Patches\n\nThe vulnerability has been fixed in v1.10.1-lts.\n\n### Workarounds\n\nIt is recommended to upgrade the version to 1.10.1-lts.\n\n### References\n\nIf you have any questions or comments about this advisory:\n\nOpen an issue in https://github.com/1Panel-dev/1Panel\nEmail us at wanghe@fit2cloud.com","status":"published","published":"2024-03-06T15:29:11Z","modified":"2026-09-10T03:50:00.237322907Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"GO-2024-2613","title":"Unauthorized Console access in github.com/1Panel-dev/1Panel","description":"If the user attempts to access a secure entry point and intercepts with Burp, they can get access to the console page. This access does not return data nor allow modification operations.","status":"published","published":"2024-03-14T17:12:53Z","modified":"2026-03-03T04:54:51.724681Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}